Pennsylvania's embattled attorney general has routinely used personal email accounts to conduct official business, transmitting confidential information and the identities of undercover agents, despite an office ban that says doing so risks security.

Kathleen Kane sent or received nearly 4,000 work-related emails through AOL and Yahoo accounts from the time she took office in January 2013 through August 2015, according to records obtained by The Associated Press.

The attorney general's office released copies of two-thirds of those emails under the state's open records law, but it deemed almost one-third exempt from disclosure, mostly on the grounds they contained sensitive or confidential material.

Among the subjects covered in the 1,144 unreleased emails, Kane's office said: personal medical and mental health; workplace discrimination, sexual harassment and employee discipline; secret grand jury and attorney-client communications; and information that could identify agents "performing an undercover or covert law enforcement activity."

A previous attorney general established a policy in 2009 that deemed using private email for office work a fireable offense.

Kane is responsible for setting office policy and had the authority to exempt herself from those rules, spokesman Chuck Ardo said. Kane said last week that she didn't know her office had such a policy until the AP asked about it, though she at least once told senior staffers they shouldn't use personal email.

Kane's spokesman said the attorney general is always on call and sometimes uses the personal accounts "to expedite matters."

The practice continues, Ardo said.

"Given her authority to choose to use her private email account, no one has attempted to dissuade her from doing so," he said.

The 2009 policy barring use of personal email is 18 pages long, states that it is critical to transmit confidential information over a secure network and warns that access to such information could cause "severe damage" to the attorney general's office.

The policy specifically mentions AOL and Yahoo as examples of "external resources" that should not be used so that "official business is never confused with personal business." Violations can result in an employee's firing.

"That policy was set by a previous AG," Kane wrote. "I had no knowledge of its existence nor did anyone indicate that this policy was in effect. We are not the Department of Justice."

Kane, a Democrat and the first woman elected to the post, has had a tumultuous first term. She is facing trial on criminal charges that she unlawfully leaked information from a grand jury investigation to a reporter and then lied about her actions. She is not seeking re-election, and her term ends in January.

She also exposed the exchange of raunchy, homophobic, sometimes pornographic emails among former members of the attorney general's office and others in the criminal justice system. Those disclosures have led to many disciplinary actions and the resignations of two Supreme Court justices.

The use of personal email accounts has been problematic for other public officials in the U.S. In October, CIA director John Brennan's AOL account was hacked and his private conversations splashed online.

Heidi Shey, a senior analyst at the technology research firm Forrester, said using personal email "creates a totally unnecessary level of risk." She called the practice "awful" and added: "Those policies are there for a reason."

Routing official email through nongovernment accounts can also cause gaps in official archives and trouble complying with subpoenas and records requests.

In Kane's case, the practice hindered the investigation that led to charges against her in August. After sweeping the state's servers, detectives discovered chunks of emails were missing.

They were in Kane's personal accounts.

Though Kane uses her personal email accounts, she admonished her staff not to. Among the documents obtained by the AP was an August 2014 email in which she asked an aide to remind senior staff members that her personal email "is not secure and should not be used."

The AP began looking into Kane's email practices when search warrant documents unsealed after her arrest showed she used personal accounts to communicate with senior staff about news coverage.

At the time, her office denied that it had a policy barring employees from using personal email for work. However, Ardo later acknowledged the 2009 policy.

No one in the attorney general's office has ever been punished for using personal email, Ardo said.

____

Follow Mike Sisak at twitter.com/mikesisak. His work can be found at http://bigstory.ap.org/journalist/michael-r-sisak and at twitter.com/APEastRegion